#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012-2018 Kaarle Ritvanen
See LICENSE file for license details
]]--

get_opts = require('alt_getopt').get_opts
lpc = require('lpc')

posix = require('posix')
signal = posix.signal

stringy = require('stringy')

-- Lua 5.1 compatibility
if not table.unpack then table.unpack = unpack end

function help()
   io.stderr:write([[
Alpine Wall
Copyright (C) 2012-2018 Kaarle Ritvanen
This is free software with ABSOLUTELY NO WARRANTY,
available under the terms of the GNU General Public License, version 2

Usage:

Translate policy files to firewall configuration files:
    awall translate [-o|--output <dir>] [-V|--verify]

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate [-f|--force]

    This command genereates firewall configuration from the policy
    files and enables it. If the user confirms the new configuration
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.

Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list [-a|--all]

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

    Normally, the command lists only optional policies. Specifying
    --all makes it list all policies and more information about them.

Dump variable and zone definitions:
    awall dump [level]

    Verbosity level is an integer in range 0-5 and defaults to 0.

Show difference between modified and saved configurations:
    awall diff [-o|--output <dir>]

    Displays the difference in the input policy files and generated
    output files since the last 'translate' or 'activate' command.

    When the --output option is used, the updated configuration is
    compared to the generated files in the specified directory
    (generated by the equivalent 'translate' command).

]])
   os.exit(2)
end

if not arg[1] then help() end

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end

opts, opind = get_opts(
   arg,
   'afo:V',
   {all='a', force='f', ['output-dir']='o', verify='V'}
)
for switch, value in pairs(opts) do
   if switch == 'a' then all = true
   elseif switch == 'f' then force = true
   elseif switch == 'c' then verbose = true
   elseif switch == 'V' then verify = true
   elseif switch == 'o' then outputdir = value
   else assert(false) end
end

if not mode then
   mode = arg[opind]
   opind = opind + 1
end


dev_mode = stringy.endswith(arg[0], '/awall-cli')
if dev_mode then
   basedir = arg[0]:sub(1, -11)
   package.path = basedir..'/?/init.lua;'..basedir..'/?.lua;'..package.path
end

util = require('awall.util')
contains = util.contains
printmsg = util.printmsg

if not contains(
   {
      'translate',
      'activate',
      'fallback',
      'flush',
      'enable',
      'disable',
      'list',
      'dump',
      'diff'
   },
   mode
) then help() end

pol_paths = {}
for i, cls in ipairs{'mandatory', 'optional', 'private'} do
   path = os.getenv('AWALL_PATH_'..cls:upper())
   if path then pol_paths[cls] = util.split(path, ':') end
end

if dev_mode then
   util.setdefault(pol_paths, 'mandatory', {'/etc/awall'})
   table.insert(pol_paths.mandatory, basedir..'/json')
end

uerror = require('awall.uerror')
call = uerror.call

if not call(
   function()
      
      local awall = require('awall')
      local printtabular = util.printtabular
      local sortedkeys = util.sortedkeys

      local policyset = awall.PolicySet(pol_paths)

      if mode == 'list' then
	 local imported = policyset:load().policies
	 local data = {}
	 
	 for i, name in sortedkeys(policyset.policies) do
	    local policy = policyset.policies[name]

	    if all or policy.type == 'optional' then
	       if policy.enabled then status = 'enabled'
	       elseif contains(imported, name) then status = 'required'
	       else status = 'disabled' end

	       local polinfo = {name, status, policy:load().description}

	       if all then
		  table.insert(polinfo, 2, policy.type)
		  table.insert(polinfo, 4, policy.path)
	       end

	       table.insert(data, polinfo)
	    end
	 end
	 
	 printtabular(data)
	 os.exit()
      end

      if contains({'disable', 'enable'}, mode) then
	 if opind > #arg then help() end
	 repeat
	    local name = arg[opind]
	    local policy = policyset.policies[name]
	    if not policy then uerror.raise('No such policy: '..name) end
	    policy[mode](policy)
	    opind = opind + 1
	 until opind > #arg
	 os.exit()
      end


      local iptables = require('awall.iptables')

      if mode == 'fallback' then

	 for _, sig in ipairs{'HUP', 'INT', 'PIPE'} do
	    signal(posix['SIG'..sig], 'SIG_IGN')
	 end

	 posix.sleep(10)

	 printmsg('\nTimeout, reverting to the old configuration')
	 iptables.revert()
	 os.exit()
      end


      local input = policyset:load()

      if mode == 'dump' then level = 0 + (arg[opind] or 0) end

      local config
      if mode ~= 'dump' or level > 3 then
	 awall.loadmodules(basedir)
	 config = awall.Config(input)
      end


      local function dump(level)
	 local json = require('cjson').new()
	 json.encode_sort_keys(true)

	 local expinput = input:expand()

	 local function capitalize(cls)
	    return cls:sub(1, 1):upper()..cls:sub(2, -1)
	 end

	 for _, cls in sortedkeys(input.data) do
	    if level > 2 or (level == 2 and cls ~= 'service') or contains(
	       {'variable', 'zone'},
	       cls
	    ) then
	       if level == 0 then io.write(capitalize(cls)..'s:\n') end

	       local clsdata = input.data[cls]
	       local items = {}

	       for _, key in sortedkeys(clsdata) do
		  local exp = expinput[cls][key]
		  local expj = json.encode(exp)
		  local src = input.source[cls][key]

		  if level == 0 then table.insert(items, {key, expj, src})

		  else
		     local value = clsdata[key]
		     local data = {
			{capitalize(cls)..' '..key, json.encode(value)},
			{
			   '('..src..')',
			   util.compare(exp, value) and '' or '-> '..expj
			}
		     }

		     if level > 3 then
			local obj = config.objects[cls][key]
			if type(obj) == 'table' and obj.info then
			   util.extend(data, obj:info())
			end
		     end
	       
		     table.insert(items, {key, data})
		  end
	       end
	       table.sort(items, function(a, b) return a[1] < b[1] end)

	       if level == 0 then printtabular(items)
	       else
		  util.printtabulars(
		     util.map(items, function(x) return x[2] end)
		  )
		  io.write('\n')
	       end
	    end
	 end

	 if level > 4 then config:print() end
      end

      local function filedump(file)
	 io.output(file)
	 dump(5)
      end

      local sysdumpfile = '/etc/iptables/awall-save'
      local dumpfile = outputdir and outputdir..'/dump' or sysdumpfile


      if mode == 'dump' then dump(level)

      elseif mode == 'diff' then
	 if not posix.stat(dumpfile) then
	    printmsg('Please translate or activate first')
	    os.exit(2)
	 end

	 local pid, stdin, stdout = lpc.run(
	    'diff', '-w', '--', dumpfile, '/proc/self/fd/0'
	 )

	 filedump(stdin)
	 stdin:close()

	 local data
	 repeat
	    -- Lua 5.2 compatibility: prefix with *
	    data = stdout:read('*a')

	    io.stdout:write(data)
	 until data == ''
	 stdout:close()

	 os.exit(lpc.wait(pid) / 256)
   
      elseif mode == 'translate' then
	 if verify then config:test() end
	 config:dump(outputdir)	 
	 filedump(dumpfile)

      elseif mode == 'activate' then

	 iptables.backup()

	 local pid, interrupted

	 if not force then
	    signal(
	       posix.SIGCHLD,
	       function()
		  if pid and lpc.wait(pid, 1) then os.exit(1) end
	       end
	    )
	    for i, sig in ipairs({'INT', 'TERM'}) do
	       signal(
		  posix['SIG'..sig],
		  function()
		     interrupted = true
		     io.stdin:close()
		  end
	       )
	    end

	    local stdio, stdout
	    pid, stdio, stdout = lpc.run(arg[0], 'fallback')
	    stdio:close()
	    stdout:close()
	 end

	 local function kill()
	    signal(posix.SIGCHLD, 'SIG_DFL')
	    posix.kill(pid, posix.SIGTERM)
	    lpc.wait(pid)
	 end

	 local function revert()
	    iptables.revert()
	    os.exit(2)
	 end

	 if call(config.activate, config) then

	    if not force then
	       printmsg('New firewall configuration activated')
	       io.stderr:write('Press RETURN to commit changes permanently: ')
	       interrupted = not io.read()

	       kill()

	       if interrupted then
		  printmsg(
		     '\nActivation canceled, reverting to the old configuration'
		  )
		  revert()
	       end
	    end

	    config:dump()
	    filedump(sysdumpfile)

	 else
	    if not force then kill() end
	    revert()
	 end


      elseif mode == 'flush' then iptables.flush()

      else assert(false) end

   end
) then os.exit(2) end